Decentralized is not risk-free: Understanding public perceptions of privacy-utility trade-offs in COVID-19 contact-tracing apps

Abstract

Contact-tracing apps have potential benefits in helping health authorities to act swiftly to halt the spread of COVID-19. However, their effectiveness is heavily dependent on their installation rate, which may be influenced by people's perceptions of the utility of these apps and any potential privacy risks due to the collection and releasing of sensitive user data (e.g., user identity and location). In this paper, we present a survey study that examined people's willingness to install six different contact-tracing apps after informing them of the risks and benefits of each design option (with a U.S.-only sample on Amazon Mechanical Turk, N = 208). The six app designs covered two major design dimensions (centralized vs decentralized, basic contact tracing vs. also providing hotspot information), grounded in our analysis of existing contact-tracing app proposals.Contrary to assumptions of some prior work, we found that the majority of people in our sample preferred to install apps that use a centralized server for contact tracing, as they are more willing to allow a centralized authority to access the identity of app users rather than allowing tech-savvy users to infer the identity of diagnosed users. We also found that the majority of our sample preferred to install apps that share diagnosed users' recent locations in public places to show hotspots of infection. Our results suggest that apps using a centralized architecture with strong security protection to do basic contact tracing and providing users with other useful information such as hotspots of infection in public places may achieve a high adoption rate in the U.S. We also offer some recommendations on how to communicate the risks and benefits of contact tracing apps with the general public.

Market-level analysis of government-backed COVID-19 contact tracing apps

“…A number of studies [4,5,8] have analyzed the contact tracing apps, mainly from the perspective of security and privacy. Li et al [5] presented a survey study to analyze the user's perceptions of the utility of contact tracing apps and the potential privacy risks due to the collection and releasing of sensitive user data.…”

“…A number of studies [4,5,8] have analyzed the contact tracing apps, mainly from the perspective of security and privacy. Li et al [5] presented a survey study to analyze the user's perceptions of the utility of contact tracing apps and the potential privacy risks due to the collection and releasing of sensitive user data. Sun et al [8] analyzed the security and privacy of 34 contact tracing apps, including potential vulnerabilities, privacy leaks, and the robustness of privacy protection approaches.…”

“…Contact tracing apps have attracted extensive attentions from the research community. A number of papers have been focused on the privacy and security issues of the contact tracing apps [4,8], the comparison of centralized and decentralized solutions [5], new protocols [6], etc. Mobile user's adoption is the key to the success of contact tracing.…”

Proof-of-Vax: Studying User Preferences and Perception of Covid Vaccination Certificates

“…The Role Of Mobile Apps in the Current Pandemic The majority of research studying the role of mobile apps to contain the pandemic focus on solutions for digital contact tracing [60,1,48,27,50,26,30]. Regarding other types of apps, Tsai et al [51] explore users' needs for explanations and transparency in symptom checking apps.…”

An Empirical Assessment of Global COVID-19 Contact Tracing Applications

“…Thus, we evaluate the user exposure of Health Code as Level IV in Table 2. However, although such solutions may collect and expose more privacy information than other solutions we discuss later, a public perceptions survey [40] indicates that the users in USA prefer centralized systems that share diagnosed users' recent locations in public venues.…”